CVE-2025-52882: Claude Code improper authorization via websocket connections

# CVE-2025-52882: Claude Code improper authorization via websocket connections

https://gcdradar.vercel.app/incidents/cve-2025-52882-claude-code-improper-authorization-via-websoc · AIR-2025-0298 · closed 2025-06-23

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-06-23
- AI role: Attack on AI
- Products: Claude Code
- CVE ids: CVE-2025-52882
- CVSS: 8.8

## Summary

Claude Code extensions for IDEs suffer from an improper authorization vulnerability in websocket connections from arbitrary origins. An attacker can exploit this to read arbitrary files and inspect IDE state.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-06-24: CVE-2025-52882: Claude Code is an agentic coding tool. (https://nvd.nist.gov/vuln/detail/CVE-2025-52882)
- 2025-06-23: CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary origins (https://github.com/advisories/GHSA-9f65-56v6-gxw7)

## Sources

- 2025-06-23 GitHub Advisory Database: CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary origins https://github.com/advisories/GHSA-9f65-56v6-gxw7
- 2025-06-24 NVD: CVE-2025-52882: Claude Code is an agentic coding tool. https://nvd.nist.gov/vuln/detail/CVE-2025-52882

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.